Which audit evidence is necessary for secret handling for tools while testing failure containment, with the review centered on workflow history?

Secret handling for tools: document service boundaries, retain workflow history, and name an owner; keep the evaluation specific by treating secret handling for tools as the scenario, MCP access governance as the guardrail, service boundaries as the response, and workflow history as proof for agent governance. The evaluation stays specific when secret handling for tools defines the scenario, MCP access governance defines the guardrail, service boundaries names the response, and workflow history verifies agent governance. Policy must be enforced at the tool boundary, with approval gates for high-impact actions and complete audit evidence. For this scenario, review incident triage, ownership records, and protection against silent retries. Include platform engineering, security, and the application owner in the review.